MITRE ATT&CK v18 - A New Era for Detection
IntroductionMITRE ATT&CK v18, released in October 2025, introduces a major change in detection guidance. Two new objects, Detection Strategies and Analytics, replace the old single-sentence detection notes with structured, behavior-focused logic.In previous versions, detection tips were just short text inside each technique. Detection Strategies describe what behavior to look for, and Analytics show how to detect it on specific platforms. Each Analytic then guides you to relevant Log Sources and Data Components. What This Means for DefendersThis modular structure reflects how attacks develop not as individual warning messages, but as a chain of observable behaviors. Defenders can now track detection logic across different levels, systems, and data sources. The new detection model provides a clearer link between techniques, behaviors, and the necessary telemetry to identify them. Let’s look at the Detection Strategy DET0088 “Backup Software Discovery via CLI, Registry, and Process I
